CISA Flags Exploited Adobe Commerce and Magento Upload Flaw

CISA added CVE-2026-48356 in Adobe Commerce and Magento to its Known Exploited Vulnerabilities catalog on October 27, with a November 10 due date. The flaw concerns unrestricted upload of a dangerous file, potentially allowing code execution in the current user’s context and greater control over an account or session. Adobe says exploitation requires no credentials; its CVE record also says a victim must follow a crafted link or interact with a compromised page. The July bulletin’s statement that Adobe knew of no exploitation predates CISA’s KEV listing.

Inventory your Adobe Commerce and Magento storefronts and check their internet exposure. Record the running versions of Commerce core, B2B and Events where installed. Adobe’s APSB26-73 identifies July-suffixed updates for affected Commerce branches from 2.4.4 through 2.4.9, B2B branches from 1.3.3 through 1.5.3, and Magento branches from 2.4.6 through 2.4.9. Commerce Events needs 1.21.0 in place of affected 1.6.0 through 1.20.0. Patch each affected Commerce, B2B or Magento branch to its listed July-suffixed release; update Events to 1.21.0 where installed.

Verify the running versions again after rollout. The expected result is the corresponding -2026-jul build for each affected core or B2B branch and Events 1.21.0 where applicable. The official records provide no named request signature; retain available storefront request, application and upload evidence for investigation of suspicious earlier activity. A current build confirms the update, while past account activity calls for separate triage.